Extracted

• • Target

    635ef412c7ecb2f3ab712a916c7f8395_JaffaCakes118

  • Size

    11.0MB

  • MD5

    635ef412c7ecb2f3ab712a916c7f8395

  • SHA1

    e99388a956bfa877b7ce648ecf8f1d9116b62e99

  • SHA256

    be2d002254d6faabfe84901983be74f44ebde466f955effa74ea990aad6aa59b

  • SHA512

    165539c6d45d799093dd42a7362db26c80d80799b1ba8e8091bab2048e258b82ff81dddcdef60ac060a897cb4eaebe608dd34f0cdd4ce44b8dcb76c9faae62a6

  • SSDEEP

    196608:5T7valuflJpZifDBtHjbHNbrkU5LNZTGywSnhrzsYxiXYqbY9ePC4aZ:9aluflrsPH5LfcMzszYqbY9em

  Score

  10^/10

  raccoone2b58b2c24d80fcfd249021c5a21ac97c09e40a1adwarediscoveryevasionpersistenceprivilege_escalationstealerupx

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V1 payload

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    evasion

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2